cognium-dev 3.212.0 → 3.214.0

package/dist/cli.js

@@ -12752,31 +12752,33 @@ function findSources(calls, types, patterns, sourceLines, language) {
     }
   }
   const RUST_EXTRACTOR_KIND = /(?:^|::)(Json|Form|Query|Path|Extension|Multipart|Body|Bytes)(?:<|$)/;
-  for (const type of types) {
-    for (const method of type.methods) {
-      for (const param of method.parameters) {
-        if (!param.type)
-          continue;
-        const kindMatch = RUST_EXTRACTOR_KIND.exec(param.type);
-        if (!kindMatch)
-          continue;
-        const kind = kindMatch[1];
-        if (kind === "Extension")
-          continue;
-        const sourceType = kind === "Form" || kind === "Query" || kind === "Path" ? "http_param" : "http_body";
-        const paramLine = param.line ?? method.start_line;
-        const alreadyExists = sources.some((s) => s.line === paramLine && s.variable === param.name);
-        if (alreadyExists)
-          continue;
-        sources.push({
-          type: sourceType,
-          location: `${param.type} ${param.name} in ${method.name}`,
-          severity: "high",
-          line: paramLine,
-          confidence: 1,
-          variable: param.name,
-          in_method: method.name
-        });
+  if (language === "rust") {
+    for (const type of types) {
+      for (const method of type.methods) {
+        for (const param of method.parameters) {
+          if (!param.type)
+            continue;
+          const kindMatch = RUST_EXTRACTOR_KIND.exec(param.type);
+          if (!kindMatch)
+            continue;
+          const kind = kindMatch[1];
+          if (kind === "Extension")
+            continue;
+          const sourceType = kind === "Form" || kind === "Query" || kind === "Path" ? "http_param" : "http_body";
+          const paramLine = param.line ?? method.start_line;
+          const alreadyExists = sources.some((s) => s.line === paramLine && s.variable === param.name);
+          if (alreadyExists)
+            continue;
+          sources.push({
+            type: sourceType,
+            location: `${param.type} ${param.name} in ${method.name}`,
+            severity: "high",
+            line: paramLine,
+            confidence: 1,
+            variable: param.name,
+            in_method: method.name
+          });
+        }
       }
     }
   }
@@ -24782,6 +24784,7 @@ class LanguageSourcesPass {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
+      additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
@@ -27638,6 +27641,58 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split(`
+`);
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*getCanonicalPath\s*\(\s*\)\s*\.\s*startsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  const assignRe = /^\s*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m)
+      continue;
+    let hasTerminator = terminatorRe.test(lines[i2]);
+    if (!hasTerminator) {
+      for (let j = i2 + 1;j < Math.min(lines.length, i2 + 6); j++) {
+        if (terminatorRe.test(lines[j])) {
+          hasTerminator = true;
+          break;
+        }
+        if (lines[j].includes("}"))
+          break;
+      }
+    }
+    if (!hasTerminator)
+      continue;
+    const guarded = new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded)
+        if (new RegExp(`\\b${n}\\b`).test(t))
+          return true;
+      return false;
+    };
+    for (let l = 0;l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2]))
+          guarded.add(a[1]);
+        else if (a[1] !== m[1])
+          guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "java_canonical_startswith_guard",
+          method: "getCanonicalPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split(`
@@ -27645,15 +27700,16 @@ function findJavaPathGetFileNameSanitizers(code) {
   const assignmentRe = /^\s*(?:(?:final\s+)?[A-Za-z_][\w.<>?,\s\[\]]*?\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const rhsHasGetFileNameRe = /\.\s*getFileName\s*\(\s*\)/;
   const rhsHasPathsChainRe = /\b(?:Paths\s*\.\s*get|Path\s*\.\s*of)\s*\(/;
+  const rhsNewFileGetNameRe = /\bnew\s+File\s*\([\s\S]*\)\s*\.\s*getName\s*\(\s*\)/;
   const candidates = [];
   for (let i2 = 0;i2 < lines.length; i2++) {
     const m = assignmentRe.exec(lines[i2]);
     if (!m)
       continue;
     const rhs = m[2];
-    if (!rhsHasGetFileNameRe.test(rhs))
-      continue;
-    if (!rhsHasPathsChainRe.test(rhs))
+    const isNioGetFileName = rhsHasGetFileNameRe.test(rhs) && rhsHasPathsChainRe.test(rhs);
+    const isNewFileGetName = rhsNewFileGetNameRe.test(rhs);
+    if (!isNioGetFileName && !isNewFileGetName)
       continue;
     candidates.push({ line: i2 + 1, boundVar: m[1] });
   }
@@ -47082,7 +47138,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.212.0";
+var version = "3.214.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.212.0",
+  "version": "3.214.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.212.0"
+    "circle-ir": "^3.214.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",